Export limit exceeded: 396954 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396954 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96601 | 1 Abdurrab5 | 1 Online-makeup-store | 2026-09-23 | 7.3 High |
| A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-80425 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-23 | 8.8 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-80412 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-23 | 8.8 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation. | ||||
| CVE-2026-80379 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-23 | 8.8 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-6935 | 1 Ibm | 1 Concert | 2026-09-23 | 7.8 High |
| IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code. | ||||
| CVE-2026-6928 | 1 Ibm | 1 Concert | 2026-09-23 | 9.8 Critical |
| IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code. | ||||
| CVE-2026-6925 | 1 Ibm | 1 Concert | 2026-09-23 | 5.3 Medium |
| IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system. | ||||
| CVE-2026-6794 | 1 Ibm | 1 Concert | 2026-09-23 | 7.8 High |
| IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process. | ||||
| CVE-2026-15064 | 1 Ibm | 2 Websphere Application Server, Websphere Application Server Liberty | 2026-09-23 | 8.7 High |
| IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens. | ||||
| CVE-2026-14981 | 1 Ibm | 2 Websphere Application Server, Websphere Application Server Liberty | 2026-09-23 | 7.5 High |
| IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits. | ||||
| CVE-2026-15328 | 1 Ibm | 2 Websphere Application Server, Websphere Application Server Liberty | 2026-09-23 | 7.4 High |
| IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling. | ||||
| CVE-2026-6730 | 1 Ibm | 1 Concert | 2026-09-23 | 9.8 Critical |
| IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system. | ||||
| CVE-2026-6721 | 1 Ibm | 1 Concert | 2026-09-23 | 9.8 Critical |
| IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code execution with the privileges of the affected application. | ||||
| CVE-2026-88840 | 1 Redhat | 1 Hummingbird | 2026-09-23 | 5.3 Medium |
| BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. | ||||
| CVE-2026-77422 | 2026-09-23 | 7.5 High | ||
| JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1. | ||||
| CVE-2026-92284 | 1 Caddyserver | 1 Caddy | 2026-09-23 | N/A |
| Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination. | ||||
| CVE-2026-6718 | 1 Ibm | 1 Concert | 2026-09-23 | 6.2 Medium |
| IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files. | ||||
| CVE-2026-89276 | 3 Adobe, Linux, Microsoft | 4 Campaign, Campaign Classic, Linux Kernel and 1 more | 2026-09-23 | 9.9 Critical |
| Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-89275 | 3 Adobe, Linux, Microsoft | 4 Campaign, Campaign Classic, Linux Kernel and 1 more | 2026-09-23 | 10 Critical |
| Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-84412 | 3 Adobe, Linux, Microsoft | 4 Campaign, Campaign Classic, Linux Kernel and 1 more | 2026-09-23 | 10 Critical |
| Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||